Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 02:51
Behavioral task
behavioral1
Sample
eec00f4d413960b8bb38bf988246560a6faf507457c786cd854b53228e40d942.dll
Resource
win7-20240215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
eec00f4d413960b8bb38bf988246560a6faf507457c786cd854b53228e40d942.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
eec00f4d413960b8bb38bf988246560a6faf507457c786cd854b53228e40d942.dll
-
Size
899KB
-
MD5
895664bf6cdb5a394b5bd0f4579d0d25
-
SHA1
06ab5eb94b7b19c47ee6b590f371870c9a96fe4f
-
SHA256
eec00f4d413960b8bb38bf988246560a6faf507457c786cd854b53228e40d942
-
SHA512
c947b77dc2af863c76b1f0233882bbdf94aa58aff5f780efb9f6db5fca45a3a5af4538c9170dda8043e53586005c25a23a6805d10d093b1796ed3c67078c7a61
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXG:7wqd87VG
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4748 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 824 wrote to memory of 4748 824 rundll32.exe 90 PID 824 wrote to memory of 4748 824 rundll32.exe 90 PID 824 wrote to memory of 4748 824 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eec00f4d413960b8bb38bf988246560a6faf507457c786cd854b53228e40d942.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eec00f4d413960b8bb38bf988246560a6faf507457c786cd854b53228e40d942.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵PID:1892